Business Continuity Plan Template for Small Introducing Firms PDF Free Download
1 / 16/16
100%
Business Continuity Plan Template for
Small Introducing Firms
[Firm Name]
Business Continuity Plan (BCP)
Updated May 12, 2010
This optional template is provided to assist small introducing firms in fulfilling their need
to create and maintain business continuity plans (BCPs) and emergency contact person
lists under FINRA Rule 4370 (Business Continuity Plans and Emergency Contact
Information). The template recognizes that many small introducing firms rely on parts of
a clearing firm’s or other entity’s BCP for many of the mission-critical functions of the
introducing firm. Nothing in this template creates any new requirements on clearing firms
or other entities, or new requirements for BCPs.
Note: Following this template does not guarantee compliance with or create any safe
harbor with respect to FINRA rules, the federal securities laws or state laws. The
obligation to develop a BCP is not a “one-size-fits-all” requirement, and you must tailor
your plan to fit your particular firm’s situation.
FINRA Rule 4370(c) requires that firms relying on another entity for elements of their
BCP or mission-critical systems must address that relationship in their plan. This
template is written for small introducing firms that use a clearing firm, and includes
sample language regarding the nature of that particular relationship only. If your firm
conducts a different type of business (e.g., sells only mutual funds), you must modify the
template to describe the entities you rely on and the nature of those relationships.
The language contained in this template is provided as a starting point for developing
your firm’s plan. It is highly unlikely that the language of this template standing alone
will fully fit your firm’s business situation. In this regard, you must customize the
language of this template to reflect your firm's activities and issues. If you have prepared
a plan in a different format, you may wish to attach the appropriate sections of that plan to
this template to confirm that you have addressed all of the individual elements.
1
Critical Elements
There are 10 critical elements of a BCP specified in FINRA Rule 4370. Each firm need
only address the elements applicable to its business, but if you do not include a specified
element in your firm’s plan, your plan must document why it is not included:
(1) Data back-up and recovery (hard copy and electronic);
(2) All mission critical systems;
(3) Financial and operational assessments;
(4) Alternate communications between customers and the member;
(5) Alternate communications between the member and its employees;
(6) Alternate physical location of employees;
(7) Critical business constituent, bank, and counter-party impact;
(8) Regulatory reporting;
(9) Communications with regulators; and
(10) How the firm will assure customers’ prompt access to their funds and
securities in the event that the member determines that it is unable to continue its
business.
Keep in mind that the above-listed elements are not exhaustive; you should address other
key areas for your plan to be complete and thorough, based on your firm’s business and
operations.
TEXT EXAMPLES are provided to give you sample language that you can modify to
create your firm’s plan.
Material in italics provides instructions, citations to relevant rules and other resources
that you can use to develop your firm’s plan.
The FINRA BCP Web page includes important information and links to other websites
with useful information. You may also consider consulting the General Accounting
Office’s reports on “Potential Terrorist Attacks: Additional Actions Needed to Better
Prepare Critical Financial Market Participants,” Report Nos. GAO-03-251(Feb. 2003)
and GAO-03-414 (Feb. 2003); the Draft Interagency White Paper on Sound Practices to
Strengthen the Resilience of the U. S. Financial System by the Securities and Exchange
Commission (SEC) and other federal financial institution regulators; and the business
continuity information on the websites of the Securities Industry and Financial Markets
Association (SIFMA), the Business Continuity Institute (BCI) and the Financial Services
Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security
(FSSCC). Firms relying on third-party providers to provide services in connection with
their BCPs should review Notice to Members (NTM) 05-48, (July 2005). For historical
guidance and background, see NTM 04-37 and Regulatory Notices 07-42 and 09-60.
2
Emergency Contact PersonsI.
Identify your firm’s two emergency contact persons. Your firm must identify its
emergency contact persons through the FINRA Contact System (FCS). In addition, your
firm must use FCS to update the contact information promptly (but no later than 30 days
following any change in the information) and annually review and update, if necessary,
the information within 17 business days after the end of each calendar year. Each
emergency contact person must be an associated person of the firm, and at least one
emergency contact person must be a member of senior management and a registered
principal of the firm. If your firm designates a second emergency contact person who is
not a registered principal of your firm, then that contact person must be a member of
senior management who has knowledge of the firm’s business operations. If your firm has
only one associated person, the second emergency contact must be an individual, either
registered with another firm or non-registered, who has knowledge of your firm’s
business operations (e.g., your firm’s attorney, accountant or clearing firm contact
person).
TEXT EXAMPLE: Our firm’s two emergency contact persons are: [name, phone number,
email] and [name, phone number, email - identify second person's relationship to the firm
if not a registered principal of the firm].
The firm will provide FINRA with the contact information for the two emergency contact
persons: (1) name; (2) title; (3) mailing address; (4) email address; (5) telephone number;
and (6) facsimile number through the FINRA Contact System (FCS). [Name] will
promptly notify FINRA of any change in this information through FCS (but no later than
30 days following the change) and will review, and if necessary update, this information
within 17 business days after the end of each calendar year.
Rule: FINRA Rule 4370(f); NASD Rule 1160.
Firm Policy II.
State your firm’s objectives for business continuity in the face of both internal and
external significant business disruptions (SBDs), including your firm’s obligation to
grant customers access to their funds and securities in the event of a significant business
disruption. This policy should be given to all employees. State who has the authority to
execute the plan, where the plan is stored, and how to access the plan.
TEXT EXAMPLE: Our firm’s policy is to respond to a Significant Business Disruption
(SBD) by safeguarding employees’ lives and firm property, making a financial and
operational assessment, quickly recovering and resuming operations, protecting all of the
firm’s books and records, and allowing our customers to transact business. In the event
that we determine we are unable to continue our business, we will assure customers
prompt access to their funds and securities.
Significant Business Disruptions (SBDs)A.
3
Our plan anticipates two kinds of SBDs, internal and external. Internal SBDs affect only
our firm’s ability to communicate and do business, such as a fire in our building. External
SBDs prevent the operation of the securities markets or a number of firms, such as a
terrorist attack, a city flood, or a wide-scale, regional disruption. Our response to an
external SBD relies more heavily on other organizations and systems, especially on the
capabilities of our clearing firm.
Approval and Execution AuthorityB.
[Name, title], a registered principal, is responsible for approving the plan and for
conducting the required annual review. [Name, title] has the authority to execute this
BCP.
Plan Location and Access C.
Our firm will maintain copies of its BCP plan and the annual reviews, and the changes
that have been made to it for inspection. An electronic copy of our plan is located on
[server name] in the [file/folder name].
Rule: FINRA Rule 4370(b), (d) and (e).
Business DescriptionIII.
State the types of business that your firm conducts.
TEXT EXAMPLE: Our firm conducts business in equity, fixed income, and derivative
securities. Our firm is an introducing firm and does not perform any type of clearing
function for itself or others. Furthermore, we do not hold customer funds or securities.
We accept and enter orders. All transactions are sent to our clearing firm, which [executes
our orders,] compares them, allocates them, clears and settles them. Our clearing firm
also maintains our customers’ accounts, can grant customers access to them, and delivers
funds and securities. Our firm services only retail customers [OR retail and institutional
customers]. We do not engage in any private placements.
Our clearing firm is [name, address, phone number, email address, website] and our
contact person at that clearing firm is [name, phone number, email]. Our clearing firm has
also given us the following alternative contact in the event it cannot be reached:
[name, address, phone number, email address, website]
Office LocationsIV.
List the locations of all of your offices, registered and unregistered, and state the means
of transportation that employees may use to reach that facility. State also which mission
critical systems, as defined below, take place at each location.
TEXT EXAMPLE: Our firm has offices located in Location #1 and Location #2.
4
Office Location #1A.
Our Location #1 Office is located at [address]. Its main telephone number is [insert]. Our
employees may travel to that office by means of [insert all that apply (e.g., foot, car,
subway, train, bus, boat, plane, etc.)]. We engage in order taking and entry at this
location.
Office Location #2B.
Our Location #2 Office is located at [address]. Its main telephone number is [insert]. Our
employees may travel to that office by means of [insert all that apply e.g., foot, car,
subway, train, bus, boat, plane, etc.)]. We engage in order taking and entry at this
location.
Alternative Physical Location(s) of EmployeesV.
List the alternate physical location(s) your firm will use in the event an SBD affects the
operation of your office locations.
TEXT EXAMPLE: In the event of an SBD, we will move our staff from affected office(s)
to the closest of our unaffected office location(s). If none of our other office locations is
available to receive those staff, we will move them to [name of firm, (if different),
address]. Its main telephone number is [phone number].
Rule: FINRA Rule 4370(c)(6).
Customers’ Access to Funds and SecuritiesVI.
State that your firm does not maintain custody of customers’ funds or securities and how
your firm will make them available to customers in the event of an SBD. State the entity
at which such funds and securities are held and how your firm will facilitate access to
them. Describe any relationship between your firm’s ability to grant customer access to
funds and securities and Securities Investor Protection Corporation (SIPC) regulations
on the disbursement of funds and securities.
TEXT EXAMPLE: Our firm does not maintain custody of customers’ funds or securities,
which are maintained at our clearing firm, [insert name]. In the event of an internal or
external SBD, if telephone service is available, our registered persons will take customer
orders or instructions and contact our clearing firm on their behalf, and if our Web access
is available, our firm will post on our website that customers may access their funds and
securities by contacting [insert contact information]. The firm will make this information
available to customers through its disclosure policy.
If SIPC determines that we are unable to meet our obligations to our customers or if our
liabilities exceed our assets in violation of Securities Exchange Act Rule 15c3-1, SIPC
may seek to appoint a trustee to disburse our assets to customers. We will assist SIPC and
5
the trustee by providing our books and records identifying customer accounts subject to
SIPC regulation [and insert any additional procedures].
Rules: FINRA Rule 4370(a); Securities Exchange Act Rule 15c3-1; see also 15 U.S.C. §
78eee.
Data Back-Up and Recovery (Hard Copy and Electronic)VII.
Identify the location of your firm’s primary books and records (hard copy and electronic)
and the location of your firm’s back-up books and records (hard copy and electronic).
Describe how your firm backs up its data. In addition, describe how your firm will
recover data in the event of an SBD.
TEXT EXAMPLE: Our firm maintains its primary hard copy books and records and its
electronic records at [address]. [Name, title, phone number] is responsible for the
maintenance of these books and records. Our firm maintains the following document
types and forms that are not transmitted to our clearing firm: [List document types and
forms, such as new account forms, etc.].
Our firm maintains its back-up hard copy books and records at [other address]. These
records are [paper copies, microfilm, etc.]. [Name, title, phone number] is responsible for
the maintenance of these back-up books and records. Our firm backs up its paper records
by copying and taking them to our back-up site. We back up our records every [time
period].
The firm backs up its electronic records daily [or other time period] by [describe
process], and keeps a copy at [other address; may be the same as hard copy back-up
site].
In the event of an internal or external SBD that causes the loss of our paper records, we
will physically recover them from our back-up site. If our primary site is inoperable, we
will continue operations from our back-up site or an alternate location. For the loss of
electronic records, we will either physically recover the storage media or electronically
recover data from our back-up site, or, if our primary site is inoperable, continue
operations from our back-up site or an alternate location.
Rule: FINRA Rule 4370(c)(1).
Financial and Operational Assessments VIII.
Describe your firm’s procedures to identify changes in its operational, financial and
credit risk exposures in the event of an SBD. Your firm should periodically assess the
changes in these exposures and quickly make such an assessment in connection with an
SBD.
6
Operational RiskA.
Operational risk includes the firm’s ability to maintain communications with customers
and to retrieve key activity records through its mission critical systems.
TEXT EXAMPLE: In the event of an SBD, we will immediately identify what means will
permit us to communicate with our customers, employees, critical business constituents,
critical banks, critical counter-parties and regulators. Although the effects of an SBD will
determine the means of alternative communication, the communications options we will
employ will include [our website, telephone voice mail, secure email, etc.]. In addition,
we will retrieve our key activity records as described in the section above, Data Back-Up
and Recovery (Hard Copy and Electronic).
Rules: FINRA Rules 4370(c)(3),(c)(4), (c)(5), (c)(7), (c)(9 & (g)(2)).
Financial and Credit RiskB.
Financial risk involves the firm’s ability to fund operations and maintain adequate
financing and sufficient capital. The firm also may face credit risk (where its investments
may erode from the lack of liquidity in the broader market), which would also hinder the
ability of the firm’s counterparties to fulfill their obligations.
TEXT EXAMPLE: In the event of an SBD, we will determine the value and liquidity of
our investments and other assets to evaluate our ability to continue to fund our operations
and remain in capital compliance. We will contact our clearing firm, critical banks and
investors to apprise them of our financial status. If we determine that we may be unable to
meet our obligations to those counter-parties or otherwise continue to fund our
operations, we will request additional financing from our bank or other credit sources to
fulfill our obligations to our customers and clients. If we cannot remedy a capital
deficiency, we will file appropriate notices with our regulators and immediately take
appropriate steps, including [insert procedures].
Rules: FINRA Rules 4370(c)(3), (c)(8) & (g)(2).
Mission Critical SystemsIX.
Describe your firm’s mission critical systems and whether your firm or your clearing
firm has responsibility for them, and your firm’s review of its clearing firm’s capabilities
to perform mission critical functions for your firm.
TEXT EXAMPLE: Our firm’s “mission critical systems” are those that ensure prompt and
accurate processing of securities transactions, including order taking, entry, execution,
comparison, allocation, clearance and settlement of securities transactions, the
7
maintenance of customer accounts, access to customer accounts and the delivery of funds
and securities. More specifically, these systems include: [list systems names and their
functions].
We have primary responsibility for establishing and maintaining our business
relationships with our customers and have sole responsibility for our mission critical
functions of order taking [and] entry [and execution]. Our clearing firm provides, through
contract, the [execution,] comparison, allocation, clearance and settlement of securities
transactions, maintenance of customer accounts, access to customer accounts and the
delivery of funds and securities.
Our clearing firm contract provides that our clearing firm will maintain a business
continuity plan and the capacity to execute that plan. Our clearing firm represents that it
will advise us of any material changes to its plan that might affect our ability to maintain
our business [and has presented us with an executive summary of its plan, which is
attached]. In the event our clearing firm executes its plan, it represents that it will notify
us of such execution and provide us equal access to services as its other customers. If we
reasonably determine that our clearing firm has not or cannot put its plan in place quickly
enough to meet our needs, or is otherwise unable to provide access to such services, our
clearing firm represents that it will assist us in seeking services from an alternative
source.
Our clearing firm represents that it backs up our records at a remote [or, preferably, out of
region] site. Our clearing firm represents that it operates a back-up operating facility in a
geographically separate area with the capability to conduct the same volume of business
as its primary site. Our clearing firm has also confirmed the effectiveness of its back-up
arrangements to recover from a wide scale disruption by testing[, and it has confirmed
that it tests its back-up arrangements every time period].
Recovery-time objectives provide concrete goals to plan for and test against. They are
not, however, hard and fast deadlines that must be met in every emergency situation, and
various external factors surrounding a disruption, such as time of day, scope of disruption
and status of critical infrastructure—particularly telecommunications—can affect actual
recovery times. Recovery refers to the restoration of clearing and settlement activities
after a wide-scale disruption; resumption refers to the capacity to accept and process new
transactions and payments after a wide-scale disruption. Our clearing firm has the
following SBD recovery time and resumption objectives: recovery time period of [e.g.,
within 4 hours]; and resumption time of [e.g., within the same business day].
[Name] will periodically review our clearing firm’s capabilities to perform the mission
critical functions the clearing firm has contracted to perform for our firm.
Our Firm’s Mission Critical SystemsA.
Order Taking1.
8
Describe how your firm will handle order taking in the event of an SBD.
TEXT EXAMPLE: Currently, our firm receives orders from customers via [insert all that
apply (e.g., telephone, fax, email, website at [insert URL], in-person visits by the
customer, etc.)]. During an SBD, either internal or external, we will continue to take
orders through any of these methods that are available and reliable, and in addition, as
communications permit, we will inform our customers when communications become
available to tell them what alternatives they have to send their orders to us. Customers
will be informed of alternatives by [insert method]. If necessary, we will advise our
customers to place orders directly with our clearing firm at [insert clearing firm contact
information].
Order Entry 2.
Describe your firm’s procedures if an SBD prevents it from entering orders received from
customers.
TEXT EXAMPLE: Currently, our firm enters orders by recording them on paper and
electronically and sending them to our clearing firm electronically or telephonically.
Alternatively, we place customer orders through [insert name of system]. We have
contacted [name of system(s)] and were told that, under its BCP, we can expect [services]
within [time].
In the event of an internal SBD, we will enter and send records to our clearing firm by the
fastest alternative means available, which include [insert means your firm will use]. In the
event of an external SBD, we will maintain the order in electronic or paper format, and
deliver the order to the clearing firm by the fastest means available when it resumes
operations. In addition, during an internal SBD, we may need to refer our customers to
deal directly with our clearing firm for order entry.
Order Execution3.
If your firm executes orders, describe your procedures if an SBD prevents your firm from
executing orders received from customers. If your firm does not execute orders, include
order execution in the list of mission critical systems that your clearing firm provides to
your firm in the next section, Mission Critical Systems Provided by Our Clearing Firm.
TEXT EXAMPLE: We currently execute orders by [describe current execution
procedures]. In the event of an internal SBD, we would [describe your execution
procedures in the event of an internal SBD]. In the event of an external SBD, we would
[describe your execution procedures in the event of an external SBD].
Other Services Currently Provided to Customers4.
TEXT EXAMPLE: In addition to those services listed above in this section, we also
[describe any other services you provide customers]. In the event of an internal SBD, we
9
would [describe how you would provide those services in the event of an internal SBD].
In the event of an external SBD, we would [describe how you would provide those
services in the event of an external SBD].
Mission Critical Systems Provided by Our Clearing FirmB.
Describe the arrangements you have with your clearing firm to provide other mission
critical systems.
TEXT EXAMPLE: Our firm relies, by contract, on our clearing firm to provide [order
execution], order comparison, order allocation, customer account maintenance and/or
access and delivery of funds and securities.
Rules: FINRA Rules 3510(c)(2) & (g)(1).
Alternate Communications Between the Firm and Customers, X.
Employees, and Regulators
A. Customers
Describe the alternate means of communications that your firm will use to communicate
with its customers in the event of an SBD.
TEXT EXAMPLE: We now communicate with our customers using [insert all that apply
(e.g., the telephone, email, our website, fax, U.S. mail and in-person visits at our firm or
another location)]. In the event of an SBD, we will assess which means of
communication are still available to us, and use the means closest in speed and form
(written or oral) to the means that we have used in the past to communicate with the other
party. For example, if we have communicated with a party by email but the Internet is
unavailable, we will call them on the telephone and follow up where a record is needed
with paper copy in the U.S. mail.
Rule: FINRA Rule 4370(c)(4).
B. Employees
Describe the alternate means of communications that your firm will use to communicate
with its employees in the event of an SBD.
TEXT EXAMPLE: We now communicate with our employees using [insert all that apply
(e.g., telephone, email, and in person, etc.)]. In the event of an SBD, we will assess which
means of communication are still available to us, and use the means closest in speed and
form (written or oral) to the means that we have used in the past to communicate with the
other party. We will also employ a call tree so that senior management can reach all
10
employees quickly during an SBD. The call tree includes all staff home and office phone
numbers. We have identified persons, noted below, who live near each other and may
reach each other in person:
The person to invoke use of the call tree is: [insert name]
Caller Call Recipients
[e.g., Person A Person B, Person C, Person D
Person C Person E, Person F, Person G.]
Rule: FINRA Rule 4370(c)(5).
C. Regulators
Describe the alternate means of communications that your firm will use to communicate
with its regulators in the event of an SBD.
TEXT EXAMPLE: We are currently members of the following self-regulatory
organizations (SROs), and are also regulated by: [insert list of applicable SRO, federal
and state securities regulators]. We communicate with our regulators using [insert all
that apply e.g., telephone, email, fax, U.S. mail, in person, etc.)]. In the event of an SBD,
we will assess which means of communication are still available to us, and use the means
closest in speed and form (written or oral) to the means that we have used in the past to
communicate with the other party.
Rule: FINRA Rule 4370(c)(9).
Critical Business Constituents, Banks, and Counter-Parties XI.
Describe your firm’s procedures to identify changes in the impact an SBD will have on its
relationship with its critical business constituents, banks, and counter-parties, and how it
will deal with those impacts.
Business constituentsA.
TEXT EXAMPLE: We have contacted our critical business constituents (businesses with
which we have an ongoing commercial relationship in support of our operating activities,
11
such as vendors providing us critical services), and determined the extent to which we
can continue our business relationship with them in light of the internal or external SBD.
We will quickly establish alternative arrangements if a business constituent can no longer
provide the needed goods or services when we need them because of a SBD to them or
our firm. [or we have entered into a supplemental contract with certain critical business
constituents to provide such services. The alternative suppliers are disclosed below.] Our
major suppliers are: [list service/product, supplier’s name, address and phone number
and any alternative supplier’s name, address, and phone number.]
Rules: FINRA Rule 4370(c)(7).
BanksB.
TEXT EXAMPLE: We have contacted our banks and lenders to determine if they can
continue to provide the financing that we will need in light of the internal or external
SBD. The bank maintaining our operating account is: [list bank name, address, phone
number, and contact]. The bank maintaining our Proprietary Account of Introducing
Brokers/Dealers (PAIB account) is [list bank name, address, phone number, and contact].
If our banks and other lenders are unable to provide the financing, we will seek
alternative financing immediately from [bank/lender name, address, and phone numbers].
Rules: FINRA Rule 4370(c)(7).
Counter-PartiesC.
TEXT EXAMPLE: We have contacted our critical counterparties, such as other broker-
dealers or institutional customers, to determine if we will be able to carry out our
transactions with them in light of the internal or external SBD. Where the transactions
cannot be completed, we will work with our clearing firm or contact those counterparties
directly to make alternative arrangements to complete those transactions as soon as
possible.
Rules: FINRA Rule 4370(c)(7).
Regulatory ReportingXII.
Describe how your firm will file its regulatory reports in the event of an SBD.
TEXT EXAMPLE: Our firm is subject to regulation by: [insert list of applicable federal,
self-regulatory organization and state securities regulators.] We now file reports with
our regulators using paper copies in the U.S. mail, and electronically using fax, email and
the Internet. In the event of an SBD, we will check with the SEC, FINRA and other
regulators to determine which means of filing are still available to us, and use the means
closest in speed and form (written or oral) to our previous filing method. In the event that
12
we cannot contact our regulators, we will continue to file required reports using the
communication means available to us. [Insert regulator contact information].
Rule: FINRA Rule 4370(c)(8).
Disclosure of Business Continuity PlanXIII.
Using the BCP statement TEXT EXAMPLE attached to this template, describe how your
firm discloses its business continuity planning to customers. Attach the current version of
your disclosure statement.Your firm may use the disclosure statement example attached
to this template. See Attachment A. If the disclosure statement example is not used, your
firm’s disclosure statement must provide the same information as discussed in the
example. Your firm’s disclosure statement need not disclose the specific location of any
back-up facilities, any proprietary information contained in the BCP or the parties with
whom the firm has back-up arrangements.
.
TEXT EXAMPLE: Attached is our written BCP disclosure statement we provide
customers at account opening [list other times of disclosure if applicable, such as
annually]. We also [post the disclosure statement on our website and] mail it to
customers upon request.
Rule: FINRA Rule 4370(e).
Updates and Annual ReviewXIV.
Describe your firm’s plan update policy and annual review of your BCP.
TEXT EXAMPLE: Our firm will update this plan whenever we have a material change to
our operations, structure, business or location or to those of our clearing firm. In addition,
our firm will review this BCP annually, on [date], to modify it for any changes in our
operations, structure, business or location or those of our clearing firm.
Rule: FINRA Rule 4370(b).
Senior Manager Approval XV.
Approve the firm’s BCP by signing below.
TEXT EXAMPLE: I have approved this Business Continuity Plan as reasonably designed
to enable our firm to meet its obligations to customers in the event of an SBD.
Rule: FINRA Rule 4370(d).
13
Signed: _______________________________
Title: _______________________________
Date: _______________________________
14
Attachment A to [Firm Name] Business Continuity Plan
TEXT EXAMPLE of BCP Disclosure Statement for Introducing Firms with a Clearing
Arrangement
[Firm Name]’s Business Continuity Planning
[Firm Name] has developed a Business Continuity Plan on how we will respond to events that
significantly disrupt our business. Since the timing and impact of disasters and disruptions is
unpredictable, we will have to be flexible in responding to actual events as they occur. With that
in mind, we are providing you with this information on our business continuity plan.
Contacting Us – If after a significant business disruption you cannot contact us as you usually
do at [firm phone number/email], you should call our alternative number [firm emergency
number] [or go to our website at {URL}]. If you cannot access us through either of those means,
you should contact our clearing firm, [name] at [clearing firm number and URL] for instructions
on how it may [list the services your clearing firm may provide to your customers in the event of
a significant business disruption; for example, provide prompt access to funds and securities,
enter orders and process other trade-related, cash and security transfer transactions for your
customers].
Our Business Continuity Plan – We plan to quickly recover and resume business operations
after a significant business disruption and respond by safeguarding our employees and property,
making a financial and operational assessment, protecting the firm’s books and records, and
allowing our customers to transact business. In short, our business continuity plan is designed to
permit our firm to resume operations as quickly as possible, given the scope and severity of the
significant business disruption.
Our business continuity plan addresses: data backup and recovery; all mission critical systems;
financial and operational assessments; alternative communications with customers, employees,
and regulators; alternate physical location of employees; critical supplier, contractor, bank and
counter-party impact; regulatory reporting; and assuring our customers prompt access to their
funds and securities if we are unable to continue our business.
Our clearing firm, [name], backs up our important records in a geographically separate area.
While every emergency situation poses unique problems based on external factors, such as time
of day and the severity of the disruption, we have been advised by our clearing firm that its
objective is to restore its own operations and be able to complete existing transactions and accept
new transactions and payments within [resumption time period]. Your orders and requests for
funds and securities could be delayed during this period.
Varying Disruptions – Significant business disruptions can vary in their scope, such as only our
firm, a single building housing our firm, the business district where our firm is located, the city
where we are located, or the whole region. Within each of these areas, the severity of the
disruption can also vary from minimal to severe. In a disruption to only our firm or a building
housing our firm, we will transfer our operations to a local site when needed and expect to
recover and resume business within [x time period]. In a disruption affecting our business
district, city, or region, we will transfer our operations to a site outside of the affected area, and
recover and resume business within [y time period]. In either situation, we plan to continue in
15
business, transfer operations to our clearing firm if necessary, and notify you through our website
[URL] or our customer emergency number, [firm emergency number] how to contact us. If the
significant business disruption is so severe that it prevents us from remaining in business, we will
assure our customer’s prompt access to their funds and securities.
For more information – If you have questions about our business continuity planning, you can
contact us at [firm business number or email address].
16
![JOINT STANDARD [-] OF 2023: CYBERSECURITY AND CYBER RESILIENCE REQUIREMENTS](https://s3.us-east-1.amazonaws.com/outstation.idea/pdf-mt/2041946698733694976/pdf/f0170b21-d2c2-47f8-92fd-8ccc6cd9af36/imgs/page1.png)
